Application of Message Compliance Detection and Intrusion Blocking Technology in Remote Operation and Maintenance System of Relay Protection

doi:10.11930/j.issn.1004-9649.202302015

Abstract

Abstract:

In the remote operation and maintenance of relay protection, there are network intrusion risks at every stage of data transmission. Existing security measures have not effectively addressed business layer risks, and some issues such as delayed risk response still exist. Therefore, a message compliance detection method and intrusion blocking technology have been proposed. By analyzing the objects, formats, business logic, and behavioral patterns of messages, a library of message compliance rules and a strategy for blocking non-compliant messages are established. Finally, modules for blocking non-compliant messages and an "emergency blocking" control module are designed and developed. The simulation testing results indicate that the proposed technology consistently blocks abnormal messages of different types as expected. This technology can effectively prevent the illegal intrusion attacks, thereby enhancing the security and stability of the remote operation and maintenance for relay protection.

Key words: relay protection, remote operation and maintenance, network security, intrusion detection, emergency control

Jiang YU, Honghui GAO, Zebing SHI, Weiwei JIANG, Fangying WU, Qingcai ZHAN, Rui ZHANG. Application of Message Compliance Detection and Intrusion Blocking Technology in Remote Operation and Maintenance System of Relay Protection[J]. Electric Power, 2024, 57(3): 135-143, 151.

Add to citation manager EndNote|Ris|BibTeX

URL: https://www.electricpower.com.cn/EN/10.11930/j.issn.1004-9649.202302015

https://www.electricpower.com.cn/EN/Y2024/V57/I3/135

Figures/Tables 21

References 26

1	王利平, 庞晓艳, 朱雨, 等. 基于物联网和移动互联的二次设备运维技术研究与应用[J]. 中国电力, 2019, 52 (3): 177- 184.
	WANG Liping, PANG Xiaoyan, ZHU Yu, et al. Research and application of intelligent maintenance system based on internet of things and mobile internet technology[J]. Electric Power, 2019, 52 (3): 177- 184.
2	曹琳. 继电保护远程运维整体架构设计[J]. 电子技术与软件工程, 2020, (21): 233- 234.
3	叶远波, 李端超, 谢民, 等. 基于知识图谱的二次设备测试自动配置方法[J]. 电力系统保护与控制, 2020, 50 (12): 162- 171. DOI
	YE Yuanbo, LI Duanchao, XIE Min, et al. Automatic configuration method of secondary equipment test based on a knowledge graph[J]. Power System Protection and Control, 2020, 50 (12): 162- 171. DOI
4	陈坤. 电力继电保护远程运维技术研究与应用[J]. 电子技术与软件工程, 2019, (18): 237- 238.
5	裘愉涛, 周震宇, 杨剑友, 等. 继电保护远程运维技术研究与应用[J]. 电力系统保护与控制, 2018, 46 (18): 17- 24.
	QIU Yutao, ZHOU Zhenyu, YANG Jianyou, et al. Research and application of remote operation and maintenance technology of relay protection[J]. Power System Protection and Control, 2018, 46 (18): 17- 24.
6	唐云泽, 苏晓茜. 电力系统网络攻击方法研究综述[J]. 中国信息化, 2020, (12): 57- 60.
7	邹洪. 智能电网信息安全防御体系架构与关键技术研究[J]. 网络安全技术与应用, 2020, (1): 113- 115.
8	梅冰笑, 周金辉, 孙翔. 基于知识图谱与细胞自动机模型的配电网信息系统风险分析[J]. 中国电力, 2022, 55 (10): 23- 31, 44. DOI
	MEI Bingxiao, ZHOU Jinhui, SUN Xiang. Analysis of distribution network information risks based on knowledge graph and cellular automata[J]. Electric Power, 2022, 55 (10): 23- 31, 44. DOI
9	鄢仁武, 郑杨, 林志雄, 等. 基于改进ECC的含电动汽车用户负荷信息保护方案[J]. 中国电力, 2023, 56 (1): 150- 157. DOI
	YAN Renwu, ZHENG Yang, LIN Zhixiong, et al. ECC based load information protection scheme for electric vehicle users[J]. Electric Power, 2023, 56 (1): 150- 157. DOI
10	郝文涛, 鲁晔, 水永莉. 工业控制网络入侵检测技术研究[J]. 工业控制计算机, 2022, 35 (4): 1- 3, 6.
11	姚鹏超, 颜秉晶, 郝唯杰, 等. 电力信息物理系统入侵容忍能力评估方法[J]. 中国电力, 2022, 55 (4): 13- 22.
	YAO Pengchao, YAN Bingjing, HAO Weijie, et al. An intrusion tolerance assessment method for cyber-physical power system[J]. Electric Power, 2022, 55 (4): 13- 22.
12	蒋南允, 程光. 智能电网入侵检测综述[J]. 网络空间安全, 2018, 9 (1): 93- 98.
	JIANG Nanyun, CHENG Guang. A review of intrusion detection in smart grid[J]. Cyberspace Security, 2018, 9 (1): 93- 98.
13	李沁雪, 刘永桂, 黎善斌, 等. 基于入侵检测的信息物理系统攻击识别综述[J]. 控制工程, 2022, 29 (6): 1049- 1057.
	LI Qinxue, LIU Yonggui, LI Shanbin, et al. A survey of attack identification based on intrusion detection in cyber-physical systems[J]. Control Engineering of China, 2022, 29 (6): 1049- 1057.
14	陶文伟, 王景, 曹扬, 等. 面向新型电力系统的人机交互统一安全认证技术[J]. 浙江电力, 2023, 42 (8): 12- 18.
	TAO Wenwei, WANG Jing, CAO Yang, et al. A unified security authentication technology based on human-machine interaction for new-type power systems[J]. Zhejiang Electric Power, 2023, 42 (8): 12- 18.
15	俞华, 穆广祺, 牛津文, 等. 智能变电站网络安全防护应用研究[J]. 电力系统保护与控制, 2021, 49 (1): 115- 124.
	YU Hua, MU Guangqi, NIU Jinwen, et al. Application research on network security protection of an intelligent substation[J]. Power System Protection and Control, 2021, 49 (1): 115- 124.
16	余萱, 苏杨, 赵威扬. 基于大数据的自动化运维安全管控平台在电网企业的应用研究[J]. 电力大数据, 2018, 21 (12): 20- 25.
	YU Xuan, SU Yang, ZHAO Weiyang. Research and application of automatic operation and maintenance in safety management and control platform in power grid enterprises based on big data analysis[J]. Power Systems and Big Data, 2018, 21 (12): 20- 25.
17	廖会敏, 玄佳兴, 李丽丽. 电力行业数字证书互信互认体系的研究[C]//2019电力行业信息化年会论文集. 2019: 55–59.
18	樊爱宛, 刘玉坤, 赵伟艇. 数字签密技术在智能电网中的应用[J]. 中国电力, 2014, 47 (7): 128- 133.
	FAN Aiwan, LIU Yukun, ZHAO Weiting. Application of certificateless signcryption scheme to smart grids[J]. Electric Power, 2014, 47 (7): 128- 133.
19	汤成俊, 李洪池, 刘文彪, 等. 继电保护远程运维可信安全方案设计[J]. 电气技术, 2023, 24 (1): 81- 85, 90.
	TANG Chengjun, LI Hongchi, LIU Wenbiao, et al. Design of reliable security scheme for remote operation and maintenance of relay protection[J]. Electrical Engineering, 2023, 24 (1): 81- 85, 90.
20	潘羿, 李彬. 基于DNSAE和随机森林的电力信息网络入侵检测模型[J]. 电力信息与通信技术, 2022, 20 (5): 23- 29.
	PAN Yi, LI Bin. Intrusion detection model of power information network based on DNSAE and random forest[J]. Electric Power Information and Communication Technology, 2022, 20 (5): 23- 29.
21	赵辉. 入侵检测在机器学习和深度学习中的发展[J]. 现代计算机, 2022, 28 (13): 62- 66.
	ZHAO Hui. Intrusion detection progress in machine learning and deep learning[J]. Modern Computer, 2022, 28 (13): 62- 66.
22	李雪莹. 基于深度学习的电力信息网络入侵检测系统设计与实现[D]. 北京: 中国科学院大学(中国科学院沈阳计算技术研究所), 2022.
	LI Xueying. Design and implementation of power information network intrusion detection system based on deep learning[D]. Beijing: Institute of Computing Technology, Chinese Academy of Sciences, 2022.
23	田里. SM2密码体系下的电网信息安全平台设计[J]. 电子技术与软件工程, 2018, (21): 193.
24	方芳, 李广华, 汪冬辉, 等. 变电站内传输IEC 62351通信密钥的加密传输方法[J]. 中国电力, 2019, 52 (10): 26- 30, 122.
	FANG Fang, LI Guanghua, WANG Donghui, et al. A symmetric encryption method for transmitting IEC 62351 communication keys in substations[J]. Electric Power, 2019, 52 (10): 26- 30, 122.
25	梁耀, 冯冬芹, 徐珊珊, 等. 加密传输在工控系统安全中的可行性研究[J]. 自动化学报, 2018, 44 (3): 434- 442.
	LIANG Yao, FENG Dongqin, XU Shanshan, et al. Feasibility analysis of encrypted transmission on security of industrial control systems[J]. Acta Automatica Sinica, 2018, 44 (3): 434- 442.
26	任辉, 栗会峰, 赵辉, 等. 电能计量用通信规约安全改造技术[J]. 中国电力, 2021, 54 (1): 167- 174.
	REN Hui, LI Huifeng, ZHAO Hui, et al. Security transformation technology for electricity metering communication protocol[J]. Electric Power, 2021, 54 (1): 167- 174.

规则名	规则类别	不合规报文特征	业务类别
白名单验证规则	通信对象合法性	通信对象不在允许的白名单范围内	通信连接
连接认证规则	通信对象合法性	建立连接后未进行认证；认证失败	通信初始化

规则名	规则类别	不合规报文特征	业务类别
白名单验证规则	通信对象合法性	通信对象不在允许的白名单范围内	通信连接
连接认证规则	通信对象合法性	建立连接后未进行认证；认证失败	通信初始化

规则名	规则类别	不合规报文特征	业务类别
报文长度校验规则	报文格式合法性	报文帧实际长度和帧内长度字节数据不一致	规约解析
帧计数错误	报文格式合法性	规约帧计数错误	规约解析
帧序号错误	报文格式合法性	规约帧序号错误	规约解析

规则名	规则类别	不合规报文特征	业务类别
报文长度校验规则	报文格式合法性	报文帧实际长度和帧内长度字节数据不一致	规约解析
帧计数错误	报文格式合法性	规约帧计数错误	规约解析
帧序号错误	报文格式合法性	规约帧序号错误	规约解析

条目		值
启动字符		68H
长度L
控制域
类型标识(TYP)		0AH
可变结构限定词(VSQ)		81H
传送原因(COT)		2BH
ASDU地址（2个字节）
功能类型(FUN)		FEH
信息序号(INF)		F1H
返回信息标识符(RII)
通用分类数据集数目(NGD)
通用分类标识序号GIN		组号
通用分类标识序号GIN		条目号
描述类别KOD		1 为从装置取实际值； 168为从子站数据库取实际值
通用分类数据描述GDD(DataType)
通用分类数据描述GDD(DataSize)
通用分类数据描述GDD(Number)
通用分类标识数据GID
······
通用分类标识序号GIN		组号
通用分类标识序号GIN		条目号
描述类别KOD		1 为从装置取实际值； 168 为从子站数据库取实际值
通用分类数据描述GDD(DataType)
通用分类数据描述GDD(DataSize)
通用分类数据描述GDD(Number)
通用分类标识数据GID